Securityvulnerabilityfixes18062026#79
Merged
Merged
Conversation
electron-builder needs a recognized lockfile to resolve the dep tree for packaging. pnpm-lock.yaml isn't detected by electron-builder 26.8.1, so we keep a dual-lockfile setup: - pnpm-lock.yaml for pnpm installs and CI - package-lock.json for electron-builder packaging Generated with npm install --package-lock-only from the current deps (dompurify 3.4.11, tldts-experimental 7.4.2, undici 7.28.0).
pnpm's module resolution caused electron-builder to miss transitive dependencies (e.g. ms) in the asar, breaking the packaged app at runtime. npm's flat node_modules + package-lock.json work correctly with electron-builder 26.x. - Revert CI workflows to npm ci / npm run - Restore npmRebuild: true for native module rebuilding - Remove .npmrc (shamefully-hoist / node-linker config) - Remove pnpm-workspace.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixing CI
Pushed back to use npm.